CVE-2025-24124
📋 TL;DR
A parsing vulnerability in Apple operating systems can cause unexpected application termination when processing malicious files. This affects users of iOS, iPadOS, macOS, visionOS, watchOS, and tvOS. The issue has been addressed through improved input validation checks.
💻 Affected Systems
- iOS
- iPadOS
- macOS
- visionOS
- watchOS
- tvOS
📦 What is this software?
Ipados by Apple
Ipados by Apple
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Tvos by Apple
Watchos by Apple
⚠️ Risk & Real-World Impact
Worst Case
Denial of service through application crashes, potentially disrupting critical workflows or services.
Likely Case
Temporary application crashes requiring user restart, causing minor productivity disruption.
If Mitigated
No impact if patched; unpatched systems may experience occasional crashes from malicious files.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious file. No public exploit code is currently available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: iPadOS 17.7.4, macOS Ventura 13.7.3, macOS Sonoma 14.7.3, visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3
Vendor Advisory: https://support.apple.com/en-us/122066
Restart Required: Yes
Instructions:
1. Open Settings app. 2. Navigate to General > Software Update. 3. Download and install the latest available update. 4. Restart device when prompted.
🔧 Temporary Workarounds
Restrict file sources
allOnly open files from trusted sources and avoid downloading files from unknown origins.
🧯 If You Can't Patch
- Implement application whitelisting to restrict which applications can open files
- Deploy endpoint protection that can detect and block malicious file parsing attempts
🔍 How to Verify
Check if Vulnerable:
Check current OS version against affected versions list. If running older than patched versions, system is vulnerable.Check Version:
iOS/iPadOS: Settings > General > About > Version. macOS: Apple menu > About This Mac > macOS version.Verify Fix Applied:
Verify OS version matches or exceeds the patched versions listed in the fix information.📡 Detection & Monitoring
Log Indicators:
- Application crash logs showing unexpected termination during file parsing operations
- System logs showing repeated application launches after crashes
Network Indicators:
- Unusual file downloads from untrusted sources to Apple devices
SIEM Query:
source="apple_system_logs" AND (event="app_crash" OR event="unexpected_termination") AND process="*parser*"🔗 References
- https://support.apple.com/en-us/122066
- https://support.apple.com/en-us/122067
- https://support.apple.com/en-us/122068
- https://support.apple.com/en-us/122069
- https://support.apple.com/en-us/122070
- https://support.apple.com/en-us/122071
- https://support.apple.com/en-us/122072
- https://support.apple.com/en-us/122073
- http://seclists.org/fulldisclosure/2025/Jan/12
- http://seclists.org/fulldisclosure/2025/Jan/14
- http://seclists.org/fulldisclosure/2025/Jan/15
- http://seclists.org/fulldisclosure/2025/Jan/16
- http://seclists.org/fulldisclosure/2025/Jan/17
- http://seclists.org/fulldisclosure/2025/Jan/19
